Target Breach Takeaway: Secure Your Remote Access

Yes, attackers could use stolen credentials to get into your systems from a distance. But slamming the door is not the answer.

Fallout from the Target breach continues to rack up as more details are revealed. The latest revelations focus on how the attackers gained the access necessary to plant the malware responsible for capturing millions of consumers' sensitive financial information: remote access using stolen credentials.

The consensus on a local radio station show I recently heard was that Target -- and others -- should reconsider whether they should continue to allow remote access. After all, no remote access, no security breach, right?

Let’s not be too hasty. Certainly, it behooves us to review how we support remote access for employees, partners, and contractors alike, to figure out whether, as with the Target breach, miscreants able to obtain the proper credentials could also be authorized access to internal systems and networks.

The real questions every organization that supports remote access should be asking are not around whether such technologies pose a significant security risk. They’re around whether the policies those technologies act on pose a significant security risk.

An audit of your remote access policies is certainly in order. Such audits should be performed at least annually, if not biannually -- and not on an ad hoc basis as a reaction to someone else’s bad luck.

There are three key areas to consider when auditing remote access policies:

1.Set boundaries. Business stakeholders should document exactly which applications and systems are vital to each remote user. A person who needs access to only two or three applications should not be allowed to roam around the network. Limit access to only what is required -- no more, no less. This is one area where you can use the Target example to your advantage, to light a fire under stakeholders.

2.Trust but verify. Evaluate how users are authorized. While login credentials are common, the Target breach shows us they can be compromised. If a username and password are the only means used to verify authenticity of a remote user, disaster awaits. Consider additional means of verifying remote users -- two-factor authentication at minimum.

3.Detect anomalies. Fraud detection has long used device (platform) and location changes as possible indicators of attempted fraudulent access using valid credentials. Investigate the ability of your remote access system to support detection of such anomalies and incorporate that into your authentication and authorization processes. Emerging technologies, such as browser fingerprinting, which aims to uniquely identify a browser from among millions of other browsers, can help identify attempts to fraudulently use valid credentials.

As attackers become more sophisticated, so too must security technology. Incorporating heuristic analysis of user behavior and location is on the cusp of providing better security through more trustworthy means of verifying the authenticity of the user behind the credentials.

Any service that's made available to the public Internet is going to pose a security risk. The key to avoiding a breach is to ensure that policies driving authorization to those services are able to make decisions in the context that requests are made.

As web-based integration wins, it's dawning on enterprises that they need a more sophisticated API strategy. Find out how to get there. Also in this issue: 3 Techs That Depend On AI. Machine learning and artificial intelligence will be key to building exciting, compelling products and services.

Lori MacVittie is a subject matter expert on cloud computing, cloud and application security, and application delivery and is responsible for education and evangelism across F5's entire product suite. MacVittie has extensive development and technical architecture experience ... View Full Bio

It is true that the HVAC account used to infiltrate Target should never have had access to the POS systems. But it did, and that was an IT mistake. However, some of the comments about the HVAC account having "read-only" access and so on indicate a lack of awareness of what really goes on. Vendors that install and maintain building systems such as HVAC, card readers for entry and the like own those systems, and IT's access to them is either non-existent or minimal. The vendors' concerns about security are also usually nonexistent. I have seen building control systems that have "admin" as the user and the company name as the password for years, and through the careers of multiple technicians. The systems in many (if not all) of the other buildings maintained by these vendors had the same exact credentials. The passwords were never changed when technicians left, no matter what the circumstances of that separation. Of course, IT could not get enforcement power over the vendors because of the siloed nature of the organizations. There are thousands of breaches waiting to happen.

I agree. Hackers should never have been able to gain access to Target's payment processors via the HVAC system. Clearly this was poor network planning. The company I work for has been providing secure remote access solutions - complete with granular access controls - to retailers for several decades. Most recently though, we introduced a new security solution designed to completely mask access to devices - like HVAC systems - except for authorized individuals. I invite you to learn more at http://www.netop.com/securem2m

"...investigators now believe that Target's attackers first accessed the retailer's network on November 15, 2013, using access credentials that they'd stolen from Fazio Mechanical Services. Theoretically, those access credentials allowed attackers to gain a beachhead inside Target's network, and from there access and infect other Target systems, such as payment processing and point-of-sale (POS) checkout systems."

It's a good read. You can check it out here: http://www.informationweek.com/security/attacks-and-breaches/target-breach-hvac-contractor-systems-investigated/d/d-id/1113728.

I don't know the details. Did they use the HVAC account to do all that or did the HVAC account enable them to penetrate the permiter defenses. Once inside, did they then leverage privilege escalation vulnerabilities in unpatched systems?

The problem is the HVAC systems weren't dealing with payment data. Stronger authentication might have helped, but so would network segmentation. The attackers shouldn't have been able to leap from HVAC controls all the way to POS systems.

You nailed two of the most important factors. Authentication is a true security measure that should be identified as well as being on site. However, the overall remote process is vulnerable. Therefore, tight very tight security measures must be taken to protect the business from any forms of threats. There are many security procedures that must take place not just two.

"This is one area where you can use the Target example to your advantage, to light a fire under stakeholders." This will be a time to pick your battles and use your leverage from this incident, certainly. In what other areas is the Target incident helping you make security arguments, readers?

I work in IT also and if the executives in your company never over ride your decisions on things like this then you work for an unusual company in my experience and based on my discussions with other IT people at other companies.

As InformationWeek Government readers were busy firming up their fiscal year 2015 budgets, we asked them to rate more than 30 IT initiatives in terms of importance and current leadership focus. No surprise, among more than 30 options, security is No. 1. After that, things get less predictable.